Japan-EU Cooperation Advances JC-STAR and CRA Comparison
Overview
The JBCE and StandICT.eu secretariats signed a cooperation memorandum, and Japan’s Ministry of Economy, Trade and Industry (METI) and IPA are launching a full-scale comparative analysis of the frameworks and security requirements of JC-STAR and the EU Cyber Resilience Act (CRA) with European experts. They aim to clarify the schemes’ commonalities and differences, facilitate companies’ compliance, and improve the cybersecurity level of IoT products.
Key points
- JBCE and the StandICT.eu secretariat signed a memorandum of cooperation on Japan-EU cybersecurity frameworks and standards collaboration.
- METI and IPA are launching a full-scale comparison and analysis of the frameworks and specific security requirements of JC-STAR and the CRA.
- By clarifying commonalities and differences between the frameworks, the initiative aims to facilitate Japanese companies’ international compliance and raise the global level of cybersecurity measures for IoT products.
Overview
As IoT products such as routers, network cameras, and sensors become widespread, cyberattacks exploiting vulnerabilities are also increasing, heightening the importance of countermeasures. In Japan, IPA operates JC-STAR under METI’s “Policy for Establishing a Security Conformity Assessment Scheme for IoT Products.”
Japan and the EU have advanced efforts to harmonize and mutually recognize cybersecurity frameworks for IoT products and to participate in international conferences. This memorandum strengthens cooperation between JBCE and the EU-funded StandICT.eu secretariat through the CRA-JC-STAR Technical Working Group (TWG). METI and IPA are also participating, and the comparison will respect the regulatory autonomy of both jurisdictions.
Impact
Clarifying commonalities and differences between the two frameworks is expected to help create an environment in which Japanese companies can efficiently comply with cybersecurity frameworks at home and abroad. METI and IPA say the work will contribute to facilitating international compliance and raising the global level of cybersecurity measures for IoT products.
Details
The memorandum is titled “Cooperation on Frameworks and Standards in the Cybersecurity Field between Japan and the EU.” JBCE and StandICT.eu will support comparisons of JC-STAR and CRA requirements and the identification of similarities and differences, while promoting meetings, dialogue among experts, and ongoing exchanges. In coordination with JBCE, METI and IPA will conduct the analysis jointly with the StandICT.eu secretariat and European cybersecurity experts.
Japan published its “Policy for Establishing a Security Conformity Assessment Scheme for IoT Products” in August 2024, and JC-STAR began operation in March 2025. The CRA entered into force in December 2024. JC-STAR has also begun mutual recognition with the UK PSTI Act and Singapore CLS. Japan participates in dialogue with the EU through StandICT.eu, the successor project to INSTAR, and also participates in GCLI, which includes interested countries.
Comparison and analysis workshops were held under the INSTAR framework on November 10, 2025 (online), January 27, 2026 (Brussels, hybrid), and June 9 (online), and under the StandICT.eu framework on September 14, 2026 (online). Experts from Japan and Europe continue to exchange views under both frameworks. Going forward, the parties will advance policy efforts to promote IoT products that incorporate countermeasures from the design stage, along with cooperation and information sharing with countries and relevant organizations.